Information Management Assessment

Central Department for Transport (DfT)

Reviewed May 2017

Published February 2018

Working with government to raise standards in information management Contents

Statement of commitment 2 IMA background 2 Executive summary 3 Good practice and key highlights 5 Recommendations to address risk areas 6 Key findings of the assessment 7 Annex A – Recommendations in full 13

© Crown copyright 2018

You may use and re-use the information featured in this report (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0.

Any enquiries regarding the use and re-use of this information resource should be sent to psi@nationalarchives.gsi.gov.uk Statement of commitment

- Before each Information Management Assessment (IMA) we recommend that a statement of commitment to the assessment process is published. The following statement from the Permanent Secretary was published by the Central Department for Transport (referred to as DfT throughout this report) in advance of the IMA as part of an internal news item highlighting the importance of proper record keeping.

‘In May the Central Department will be subject to an independent assessment of our Information Management by The National Archives. This is part of the regular programme of assessments that The National Archives conduct to review information, records and knowledge management standards within Government.

It is an opportunity to demonstrate the significant progress made since our last assessment in 2009, and to help shape ongoing work to modernise our records-keeping systems and processes. If you have been contacted by the Information & Security Division to take part, then please do give them your full support.

DfT recognises the importance of meeting its corporate obligations to effectively manage, protect and exploit the information it creates and holds. The final report that The National Archives produces will help Exco support all aspects of knowledge and information management across the Department. This will help ensure that our information, knowledge and records are appropriately captured, managed and preserved, and information risks and sensitivities are appropriately handled’.

IMA background

The first IMA of DfT was formally closed in 2014. The 2017 IMA reassessment involved a detailed review of supporting documentation followed by interviews with senior staff, specialists and practitioners in the department’s London offices between 8 and 11 May 2017. Additional interviews with key staff were conducted by telephone later in the month. This report provides a summary of the good practice and risks we identified focussing on high priority findings. Executive summary

- There are 10 performance headings embedded in this IMA report. DfT receives a satisfactory rating under five headings. This rating indicates an approach that is positioned to support efficiency and effectiveness and compliance with legal obligations and responsibilities.

- In addition, DfT receives one high priority ‘Development area’ rating, and four medium priority ‘Development area’ ratings. A development area rating indicates a key issue or gap in process or governance that may trigger a range of risks.

- Positive approaches and key improvements made since the last IMA are included in the highlights section below on page 5.

Ratings received ranked by priority

| Performance Rating | Priority | Report section | |--------------------|----------|-------------------------------------| | Development area | High | 1.1 Communicating and realising value |

To improve performance under this heading DfT needs to:

- build on the good start made through the information management modernisation project and put in place a defined plan to improve the department’s information and records management culture. This should tackle known and potential areas of weakness and build on the good practice that already exists.

- establish a joined-up strategic vision for the effective management and exploitation of information and records to drive and direct necessary improvement work.

| Performance Rating | Priority | Report section | |--------------------|----------|-------------------------------------| | Development area | Medium | 2.1 Supporting information through technology | | Development area | Medium | 2.2 Digital continuity and IT change | | Development area | Medium | 3.1 Recognising information risk | | Development area | Medium | 3.3 Providing guidance |

To improve performance under these headings DfT needs to:

- provide an improved foundation for staff to manage and exploit information by continuing to invest energy in improving the DfT IT environment. DfT should consider the proportionate use of technical controls to help shape good practice and should formally work to roll-out SharePoint Online with the planned introduction of Office 365.

- put in place concrete plans to ensure that digital information remains complete, available and usable for business needs. This should include the department’s information assets and other datasets held in bespoke systems.

- review central definitions of information and records management related risk and ensuring this type of risk is covered explicitly in the department’s information risk policy.

- improve guidance to staff on what records they need to keep and publish retention schedules as recommended in Sir Alex Allan’s 2014 Records Review report.¹

| Performance Rating | Priority | Report section | |--------------------|----------|-----------------------------------------------------| | Satisfactory | Low | 1.2 Managing information as an asset | | Satisfactory | Low | 3.2 Establishing control | | Satisfactory | Low | 3.4 Measuring impact | | Satisfactory | Low | 4.1 Oversight of records and selection | | Satisfactory | Low | 4.2 Implementing disposal decisions |

To maintain performance under these headings, DfT needs to:

- utilise its existing information asset governance framework to identify and manage a wider range of risks to information assets including those related to retention and usability.

- put in place an effective basis for information management governance in the new IT environment with responsibility for local championing of good practice and administrative support allocated.

- ensure a proportionate monitoring regime is put in place so that bad practice can be challenged and good practice can be promoted and rewarded.

- gain a better understanding of digital holdings with support from The National Archives.

- put in place a plan for the appraisal, selection and transfer of digital records.

IMA reports and departmental action plans are published on The National Archives’ website at: nationalarchives.gov.uk/information-management/our-services/ima-reports-action-plans.htm

¹ https://www.gov.uk/government/publications/records-review-by-sir-alex-allan Good practice and key highlights

The following are among the areas of good practice identified at the time of the assessment. They include approaches that other government organisations may find helpful in mitigating information and records management related risks:

| Highlights of the 2017 IMA | |---------------------------| | • Many of the staff we spoke to understood the importance of managing information effectively. We saw evidence that a number of business areas were proactively working to encourage good practice through Friday filing initiatives, discussion in team meetings and use of incentives and rewards. Backing from senior staff was also evident. Some Deputy Directors were seen to be actively reinforcing messaging from BROs, ensuring the importance of taking action was recognised. | | • DfT delivered a records management improvement plan in 2016/17. A key focus was establishing a supported BRO network. This was enabled through building and maintaining a community. An annual BRO conference is now established and BROs are supported through regular communications and newsletters. | | • The information modernisation project was a further output from the records management improvement plan. The project has senior support and has a clear focus on improving DfT’s ability to manage and exploit its information through the introduction of SharePoint Online. DfT has worked to define business requirements for information and records management. It plans to use third-party software to help address areas where these are not currently met by the standard product. | | • DfT has taken an important first step by defining key digital continuity outcomes in its future information principles. These set out key risk factors including the impact of change and the differing lifecycle of information and the technology that hosts it. The need to maintain the digital continuity of information during migration between systems is emphasised in the migration strategy and information management modernisation project papers for the Executive Committee. | | • One risk captured on a risk register at Director General Group level clearly defines the role that poor information management practice could have on the business’s ability to make effective decisions and comply with corporate and legal obligations. It highlights the potential effect of this in terms of increased difficulty finding key legacy documents, including wasted staff time. Mitigating actions focus on work to improve information management culture and embracing opportunities offered by the coming move to SharePoint. | | • DfT required its agencies to complete The National Archives’ IMA self-assessment questionnaire in advance of the IMA to enable a whole department approach to measuring capability and mitigating risk. ² | | • Review services continue to be provided by the Department for Communities and Local Government (DCLG) on a shared service basis. We saw good evidence of active planning to ensure future workloads are distributed effectively and peaks and troughs are avoided. DCLG review staff have built up a considerable knowledge of |

² [http://www.nationalarchives.gov.uk/information-management/manage-information/ima/information-management-self-assessment-tool/](http://www.nationalarchives.gov.uk/information-management/manage-information/ima/information-management-self-assessment-tool/) DfT. Records are looked at prefix level. Reviewers look at disposal agreements and Official Selection Policies and also the history of what records have previously been transferred to The National Archives.

## Recommendations to address risk areas

Full details can be found in Annex A (see p. 00)

| Recommendation | To address a high-priority development area rating | |----------------|---------------------------------------------------| | 1 | Establish a programme of work to establish and embed the right information management culture. This should be closely integrated with planned IT change. | | 2 | Establish and communicate a clear vision and strategy for information management. |

| To address a medium-priority development area rating | |---------------------------------------------------| | 3 | Apply continued focus to the delivery of an improved IT environment that will make good information management practice easier to achieve. | | 4 | Build on the work to embed digital continuity as part of the proposed information principles, putting in place concrete plans for Knowledge and Information Management (KIM) and IT staff to deliver digital continuity and information management priorities. | | 5 | Review corporate descriptions of information and records management related risk to ensure causes and mitigating actions reflect the wider current and future IT environment, including the planned introduction of Office 365. | | 6 | Engage with the business and establishing more concrete and tailored principles for capturing and managing information and records. |

| To maintain a satisfactory rating | |----------------------------------| | 7 | Build on the existing information asset governance framework and seek opportunities to surface and manage information and records management related risks to information assets. | | 8 | Strengthen arrangements for information management governance and oversight of performance in the new IT environment. | | 9 | Increase oversight of digital information and develop a process for its appraisal, selection and transfer. | Key findings of the assessment

1 The value of information

Key developments since the last IMA:

- A 2016-17 Records Management Improvement plan has delivered a renewed focus on the Business Records Officer network and provided impetus to the department’s Information Management Modernisation project.

| Performance heading | Performance rating | Priority | |--------------------------------------|----------------------|----------| | 1.1 Communicating and realising value| Development area | High |

- At the time of the IMA, a number of key individuals at board level who were identified as particularly supportive had left or were about to leave the department. DfT should realise the Information Management Modernisation project objective of appointing a senior business champion for information management. This would help ensure continuity and provide a formal basis for senior sponsorship of future knowledge and information management initiatives. See recommendation 1

- DfT has no agreed vision or strategy for information management to provide impetus and drive good practice in overall terms. As discussed below, the Information Management Modernisation project is well-placed to direct work to replace the department’s shared drives. However, the new SharePoint Online platform that is being introduced is only one component of the department’s IT environment. DfT needs to establish an overall approach to encourage and enable the effective management of information in all locations and help inform consistent decision making. While we saw some evidence that information management requirements had been factored into change processes, these may be missed if objectives are not formalised and communicated. The Information Management Modernisation project’s future information management principles may provide a solid starting point for this work. See recommendation 2

- A number of senior interviewees identified improving the department’s information and records management culture as a priority. While we saw a number of positive examples of business areas that were actively working to promote information and records management as an important activity to staff, practice is not consistent across the department. A strong emphasis on information and records management culture is needed to help ensure expected benefits are achieved from planned IT changes. A programme of work should be put in place to support this. DfT should draw on good practice examples of programmes run by IMA programme members including Welsh Government and HM Treasury. See recommendation 1 DfT has adopted an active approach to Information Asset Owner (IAO) engagement. This uses questionnaires and face-to-face interviews to ensure responsibilities are understood. It is introducing a new tool to help gain a better and more objective understanding of the confidentiality, integrity and availability related risks to which its information assets are subject. DfT also adopts a proactive approach to training and upskilling IAOs.

However, while DfT’s approach for supporting IAOs is broadly good, we note that it is not currently making the most of its information asset register. This includes logging key details such as the significance of the asset and the format information is held in or specific criteria relating to retention. Information Security and Knowledge and Information Management (KIM) staff, should work together to ensure risks relating to lifecycle management and digital continuity of information assets are monitored. This includes information assets held outside the SharePoint Online and Office 365 environment. See recommendation 7

2 Digital information and supporting technology

Key developments since the last IMA:

- DfT has worked proactively to enforce limits on personal drives and has stopped adding to its substantial legacy archive of 80 million emails. A project to reduce the archive saw emails from prior to 2010 captured or destroyed before the process was stopped due to the Independent Inquiry into Child Sexual Abuse.

- DfT has conducted analysis to understand the age and format of its digital information. It has identified corrupted and untrustworthy metadata in its early digital records. These were not selected for transfer to The National Archives.

DfT recognises that while governance rules establish how shared drives should be used, the current shared drive environment does not meet key requirements for records systems set out in the Section 46 Code of Practice. While DfT has made some key steps in addressing risks relating to storage of information outside corporate spaces, management of current email is an ongoing area of concern. No meaningful controls are in place to help limit storage capacities. DfT holds a volume nearly equivalent to its legacy email archive in current mailboxes (70 million emails), with more than 1000 mailboxes holding more than the recommended current limit of 2GB. See recommendations 3 • DfT has clearly invested a considerable amount of effort in establishing business requirements for information and records management. We saw positive evidence that these have underpinned work to introduce SharePoint Online. This is progressing ahead of the planned introduction of Office 365. While the introduction of SharePoint Online offers the opportunity to improve DfT’s capability, we emphasise that these two pieces of work should be formally aligned. This is required to support a whole IT environment approach to information capture and storage and to minimise the risk raised by increased access to personal repositories. See recommendation 3

| Performance heading | Performance rating | Priority | |--------------------------------------|--------------------|----------| | 2.2 Digital continuity and IT change | Development area | Medium |

• DfT is working to address a number of digital continuity related risk areas ahead of migration. This includes file-path length and the existence of email stubs in the file plan. However, digital continuity is not yet embedded on a business-as-usual basis in departmental planning and there is no programme of work in place to protect information that may be at risk. Key potential risk areas include the retention of information in the wider Office 365 environment and in existing and legacy email holdings. The need to hold data and information over the long term, including, for example, content held and used by DfT’s accident investigation teams, also needs to be considered. KIM and IT teams need to work together to define how the digital continuity will be ensured in practice, and to deliver the migration strategy goal of defining usability requirements following the migration. See recommendation 4

• For the migration itself, DfT should ensure a clear policy is in place in relation to information identified as being at risk of digital continuity loss including non-identifiable file formats. See recommendation 4

• Historically, the KIM team has lacked a formal route in to the IT procurement process. The situation was expected to improve due to recent governance changes. DfT must ensure that business requirements for information and records management, including digital continuity, are considered routinely. See recommendation 4

3 Information risk, governance and oversight

Key developments since the last IMA:

• An information risk policy was produced in 2012 and an audit of records management was conducted in 2014. This included consideration of compliance with policies and procedures.

• An information management modernisation project board is in place, which is chaired by the Head of the Digital Service division. DfT places a strong corporate focus on cyber-security and personal information related risks. DfT should ensure descriptions of these risks reflect the potential impact of information and records management practice. See recommendation 5

Though we saw evidence of business areas taking ownership of the risk of non-compliance with information and records management policy (see good practice and key highlights, p. 5), DfT’s information risk policy does not cover information and records management. This needs to be updated to provide a definition of this type of risk and the structures for managing it, including business ownership and the role of the KIM team and Departmental Records Officer (DRO). See recommendation 5

Corporate descriptions of information and records management-related risk causes and mitigating actions do not reflect the wider current and future IT environment, including the planned introduction of Office 365. This should be addressed and the impact and likelihood should be reassessed in light of this report. See recommendation 5

DfT also needs to define the risk of a failure to ensure digital information remains usable. See recommendation 5

At the time of the IMA, links between information assurance and KIM staff and colleagues in IT appeared informal. Following the foundation of the Digital Service division, DfT now needs to support and enable more formal communication through membership of governance boards. See recommendation 8

Historically, the Business Records Officer (BRO) role has not provided a fully effective means of ensuring consistent compliance with policy. Recent work to increase the effectiveness of the role (see good practice and key highlights, p. 5) has delivered tangible benefits. DfT plans to review the role. In the meantime, it should ensure the role continues to be supported and developed to drive the right culture. See recommendation 8

DfT has identified a requirement to nominate senior information champions within Director General Groups during delivery of the information management project. Following the model of other IMA programme members such as HM Treasury (which has done so on a best practice basis) DfT should consider embedding this role on a business as usual basis. To help drive and embed an effective culture in the long-term, DfT should establish the link between this role and the BRO role and any successor to it. In doing so, it should give consideration to the split between system administration and driving positive behaviours across the IT environment as a whole. See recommendation 8

| Performance heading | Performance rating | Priority | |---------------------------|-----------------------|----------| | 3.3 Providing guidance | Development area | Medium |

- DfT has a high-level information and records management policy. This includes summary principles on what records to keep. DfT should take the opportunity offered by the move to SharePoint Online to work with business areas to establish more concrete and tailored guidance on what needs to be kept in practice. Data and key outputs from data analytics should be brought explicitly within scope. DfT should publish its retention schedules publicly in accordance with the recommendation made in Sir Alex Allan’s 2014 Records Review report. See recommendation 6

- As noted above, email management is an ongoing area for improvement. Although requirements related to policy submissions did appear to be understood, in wider terms, staff were not always clear which emails needed to be captured and by whom, or that email chains where relevant need to be captured as well as attachments. DfT also needs to ensure clear principles are established for staff in relation to handling of drafts and documenting context around key decisions taken. We saw evidence that in some cases staff are capturing final decisions only. See recommendation 6

- DfT should promote clear principles in both cases as part of the recommended department-wide work to embed the right information management culture. It should also provide a stronger push on information and records management as part of the induction and leavers process. Information management policy should set clear expectations for all staff including managers, clearly communicating responsibilities. See recommendations 6

| Performance heading | Performance rating | Priority | |---------------------------|-----------------------|----------| | 3.4 Measuring Impact | Satisfactory | Low |

- DfT asks BROs to complete an annual self-assessment questionnaire, which is used to inform KIM team priorities for the following year. A range of KIM criteria have also been added to the management assurance questionnaire. However, DfT currently lacks an objective means of monitoring compliance with policy, supporting standards, procedures and guidelines as recommended by the Section 46 Code of Practice. The risks raised by this are to an extent mitigated by the current direct engagement with business areas in preparation for the coming migration to SharePoint Online. Beyond this, a robust monitoring regime needs to be established to underpin work to improve information and records management culture. See recommendation 8 4 Records, review and transfer

Key developments since the last IMA:

- The KIM team has started an audit of paper files held in the business to ensure it has a clear idea of what is held.

| Performance heading | Performance rating | Priority | |--------------------------------------|--------------------|----------| | 4.1 Oversight of records and selection | Satisfactory | Low |

- DfT has a good understanding of records held in its shared drives. It is also able to subject its legacy email holdings to scrutiny using e-Discovery tools.

- However, the KIM team has less oversight over information held outside its shared drives. This includes information assets and other datasets. In line with the recommended establishment of a holistic strategic vision for information management, DfT should broaden its definition of a record to cover information in all formats and locations. See recommendation 9

| Performance heading | Performance rating | Priority | |--------------------------------------|--------------------|----------| | 4.2 Implementing disposal decisions | Satisfactory | Low |

- DfT is currently compliant with the Public Records Act in terms of paper records. The 2016-17 Records Management work plan included a requirement to analyse and assess technical and resource requirements for digital transfer, but DfT has yet to identify how this will happen in practice. It needs to engage with The National Archives in defining requirements, including for early transfer where desirable, to maintain a satisfactory rating under this heading. See recommendation 9

- Routine disposal of current digital information in line with retention schedules has been happening to a limited degree only. However, DfT plans to address this through the different treatments to records held in the shared drives through the migration process, including disposal of redundant, obsolete and trivial information. This will include any information assessed as being past its disposal date.

- DfT is not destroying legacy material in view of the Independent Inquiry into Child Sexual Abuse. It needs to identify a clear plan for disposal of information held outside the shared drives, including information assets, data and its email holdings including its email legacy. Clarifying its risk appetite for information risks, including those related to disposal, may be helpful here. See recommendation 9 Annex A – Recommendations in full

- Recommendations consist of an overall outcome to be delivered through the period of DfT IMA action plan and a set of supporting actions that will help DfT address the recommendation.

### High-priority recommendations

| 1 | DfT to establish a programme of work to establish and embed the right information management culture in the new IT environment. This should be closely integrated with planned IT change. | |---|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | This would be supported by: | | | - Drawing on good practice examples of work to improve culture and behaviours from organisations in the IMA programme, including HM Treasury and Welsh Government. | | | - Appointing an overall board-level champion for information and records management to lend support to planned initiatives. | | | - Ensuring a focus on recognised issues and risk areas such as improving how staff work with and manage email, the retention of drafts and key context, and the unnecessary capture and retention of ephemeral material. |

| 2 | DfT to establish and communicate a clear vision and strategy for information management. | |---|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | This would be supported by: | | | - Using the information management modernisation project’s future information principles as a starting point. | | | - Adopting a format-blind approach that encompasses data and records management outcomes. | | | - Establishing concrete plans to socialise and implement the strategy. | Medium-priority recommendations

| 3 | |---| | **DfT to apply continued focus to the delivery of an improved IT environment that will make good information management practice easier to achieve** | | **This would be supported by:** | | • Formally establishing the link between the information management modernisation project and the forthcoming roll out of the wider Office 365 environment. | | • Adopting a whole IT environment approach to information architecture and information capture and storage, with consideration given to proportionate use of controls to help shape behaviours and limit the potential for bad practice. |

| 4 | |---| | **DfT to build on the work to embed digital continuity as part of the proposed information principles, putting in place concrete plans for KIM and IT staff to deliver digital continuity and information management priorities.** | | **This would be supported by:** | | • Ensuring digital continuity principles are applied to the whole IT environment, including the wider Office 365 environment, current and legacy email holdings. | | • Ensuring that consideration of retention and digital continuity are factored into the IT procurement process as standard. | | • Putting in plan a clear policy in relation to the migration of information at risk of digital continuity loss including non-identifiable formats. | DfT to review corporate descriptions of information and records management related risk to ensure causes and mitigating actions reflect the wider current and future IT environment, including the planned introduction of Office 365.

This would be supported by:

- Reviewing the impact and likelihood of the risk and ensuring scrutiny at a directorate as well as a divisional level.

- Updating the information risk policy to provide a clear steer on information and records management related risk, including structures and roles for managing it. DfT should consider extending this to business ownership of compliance related risk, drawing on best practice examples that already exist within the department.

- Defining the risks related to digital continuity and logging these at an appropriate level.

- Ensuring the role of information and records management is factored in to definitions of other information related risks including those relating to cyber security and loss of personal and sensitive information.

DfT to engage with the business and establishing more concrete and tailored principles that establish what information staff need to capture and keep

This would be supported by:

- Reviewing information and records management policy to ensure key requirements set out in the Section 46 Code of practice are factored in.

- Paying particular attention to key areas such as email chains, drafts, evidence of decision and key context.

- Ensuring consistent coverage of information and records management as part of induction and leavers processes.

- Clearly establishing required behaviours for all staff including managers and senior staff in information management policy.

- Publishing retention schedules on GOV.UK in line with recommendations in Sir Alex Allan’s *Records Review*.

## Recommendations to maintain a satisfactory rating

### 7

**DfT to build on the existing information asset governance framework and seek opportunities to surface and manage information and records management related risks to information assets.**

**This would be supported by:**

- Ensuring KIM and information security staff work together to ensure risks relating to disposal of information assets are identified and monitored.

- Ensuring KIM and information security staff work together to identify and monitor risks relating to digital continuity of information assets and datasets, especially bespoke data sets held outside the core system that needs to be held over the long term.

### 8

**DfT to strengthen arrangements for information management governance and oversight of performance in the new IT environment**

**This would be supported by:**

- Appointing business champions for information management on a business as usual basis, beyond the SharePoint Online roll-out period.

- Defining the relationship between this role and the BRO role (or its successor) to allow system administration and promotion of required behaviours across the IT environment as a whole. In the meantime DfT should continue to support the BRO role.

- Ensuring information management representation on IT, data and digital focussed governance boards.

- Establishing requirements for a robust monitoring regime once the new IT environment is in place to map the maturity and capability of business areas. DfT needs to ensure good practice can be shared and poorly performing areas can be identified and targeted. DfT to increase oversight of digital information and develop a process for its appraisal, selection and transfer.

This would be supported by:

- Ensuring a clear vision of what information needs to be in scope across the IT environment as a whole. Datasets and data analytics outputs should be factored in.

- Establishing a plan for the information held outside the shared drives including its email legacy and for ensuring material that should form part of the record is captured.

- Engaging with The National Archives and cross-government work around the sensitivity review of digital information.

- Working with The National Archives to establish a plan for the routine transfer of digital records. This should include identification of material that would benefit from transfer before deadlines established by the Public Records Act.